Data has proven to be an important asset of enterprises, and the rapid growth of data has made enterprises facing unprecedented challenges. Meanwhile, the cost pressure brought by the rapidly changing world economic situation and fierce competition enables enterprises to have to consider how to reduce IT costs and meet the growing storage needs of enterprises.
The existing storage architecture can be classified into two types: one is a proprietary architecture for one party, such as the DAS (Direct Attached Storage), SAN (Storage Area Network, Storage Area Network) and NAS (Network Access Server,). Such storage systems are exclusively used by one party and can provide users with very good control, better reliability and performance, but due to their poor scalability, they do not apply to large-scale deployment; it is quite difficult for users in this mode to flexibly use storage budgets, and a one-time investment is needed to buy storage equipment; along with the increase in storage capacity, the cost control will also face challenges.
The other is a multi-party sharing architecture, that is, cloud storage architecture. According to their different service scopes, they are classified into private cloud and public cloud. The architecture of cloud storage based on network technologies (internet and intranet) provides users with on-demand purchasing and leasing of storage space, and on-demand configuration service; namely, usually, a third party or third-party department in enterprises provides storage apparatus and specialized maintenance personnel. Through the storage service, enterprises or various departments within the enterprises can significantly reduce their internal storage requirements and corresponding administrative costs, to balance the sharply rising storage requirements and business cost pressure. The users who adopt the storage service can be individuals, enterprises, or even departments within the enterprises or branch offices.
However, in either mode of operation (private cloud and public cloud), the data owners will inevitably concern about the security and privacy of its data, especially public cloud storage users whose key business data leakage may cause inestimable losses.
All existing methods to protect the cloud storage data security are to encrypt the data to be stored. However, none of existing encryption algorithms being used can be proven unbreakable, details can be seen in pages 6 and 12 of Applied Cryptography Protocols, Algorithms and C Source Code issued by the China Machinery Industry Press on Mar. 1, 2003. However, as decryption technology develops continuously, hardware price declines and performance rises drastically, the security of encryption algorithm will become increasingly unsafe.
In addition, in order to ensure the encryption and decryption speed of the data to be stored, the existing cloud storage services usually do not adopt the most complicated encryption algorithms within the industry, otherwise the storage performance would become relatively slow, which will add to users' concern over the reliability of encryption algorithm.
Moreover, once the users' data is stored into a cloud storage data center with some kind of encryption algorithm, it is difficult to be changed according to actual situation, e.g., the encryption algorithm used has been cracked. It should be noted that with the existing methods the file or the partial file is generally stored in the sequence of content. It can be imagined that what kind of loss it would cause once an enterprise’ key business data is illegally obtained and decrypted by others.
So far, in Cryptology, only the one-time pad method (hereinafter referred to as “OTP”) is mathematically proven unbreakable. For details, see U.S. Pat. No. 1,310,719, SECRET SIGNALING SYSTEM. Specifically, this method is to encrypt each bit of plaintext data with true random cryptographic key; the length of the cryptographic key should not be smaller than that of the plaintext data. Under this method, each bit of the plaintext data and the cryptographic key used are of equal probability. Therefore, no matter how many ciphertexts the cryptanalyst may have, they cannot get the unique solution. This kind of method is called unconditionally secure in cryptology.
OTP can provide perfect data security protection, but in practical application, especially, in applying into cloud storage data security protection, there are many challenges:
1. OTP encryption method requires that the length of the cryptographic key should be at least equal to the length of the encrypted plaintext, which is to say, the physical storage space of the cryptographic key of the encryption method should be no less than that of the plaintext, which contradict the users' original intention to save their local storage space by using a cloud storage service.
2. This encryption method requires sufficient, non-repeatable and true random cryptographic keys so that the cryptanalysis cannot generate the same cryptographic key according to some method.
If OTP is applied to cloud storage data security protection, the most core problem is the generation of true random cryptographic keys, which is to say, how to save and generate sufficient, unduplicated and true random cryptographic keys no shorter than the plaintext with a relatively small physical space in comparison of that of plaintext. The traditional OTP true random cryptographic key generation can be categorized into the following types:
One type is to generate one pad of certain length, and to specify the cursor position and data acquisition length one time to generate OTP cryptographic key. For details, please refer to U.S. Patent Application Publication No. U.S. 2006/0177065, System and Methods for Encrypting Data Utilizing One-Time-Pad Key, China Patent Application No. CN200610122291.7, An Improved One-time Pad Software Protection Method. This type of method, by introducing the memory address or the like, has enhanced the randomness of the cursor positions used by it. However, limited by the length of the pad, it is difficult to generate sufficient, unduplicated and true random cryptographic keys in conforming to the requirement of generating OTP cryptographic key. The cryptanalysts, when intercepting enough ciphertexts, may reversely generate the pad, which will make the security of the whole system become vulnerable.
Another type is to generate cryptographic key by pseudorandom numbers. For details, please refer to U.S Patent Application Publication No. U.S. 2003/0142821, Cryptographic One Time Pad Technique, and U.S. Pat. No. 7,197,142, System and Methods for A Vernam Stream Cipher. However, this method disobeys the unbreakable theoretical basis of OTP, that is, all cryptographic keys used in OTP should be true random and impossibly regenerated from another place at another time. However pseudorandom number apparatus is possibly reproducible or unexpectedly intercepted by some means, which will cause the security of the whole system become vulnerable.
The third type is to generate random cryptographic keys with various methods and statically save them to a specified storage media, such as a floppy disk, CD, etc. See U.S. Pat. No. 6,324,287, Pad Encryption Method and Software. Such a method can generate sufficient real random cryptographic keys, but the storage space of the real random cryptographic keys is not smaller than that of the plaintext, which contradicts the original intention of cloud storage.
The fourth type is, under the premise of the same pad, through the identical selection procedure to choose random numbers from the same pad to generate identical random cryptographic keys at two different places. See U.S. Pat. No. 6,445,794, System and Method for Synchronizing One Time Pad Encryption Keys for Secure Communication and Access Control, U.S. Pat. No. 6,266,413, System and Method for Synchronizing One Time Pad Encryption Keys for Secure Communication and Access Control.
However, the identical random number selection procedure in this method itself causes the choosing of random data or cryptographic keys to be regular or reproducible. In case this selection procedure is leaked, then the security of the whole system will become vulnerable.
The fifth method is to focus on solving the transmission synchronization problems of the one-time pad. Still it requires a random cryptographic key no shorter than the plaintext before the transmission synchronization. See U.S. Pat. No. 6,337,910, Method and Apparatus for Generating One Time Pads Simultaneously in Separate Encryption/Decryption Systems.
The last method, though called one-time encryption one time key, its core principle is to change the cryptographic key during encryption each time, which is different from the procedure to encrypt each bit with different random cryptographic keys specified in OTP and, therefore, is not in the scope of OTP. For details, refer to China Patent Application No. 200610122291.7, One-time Pad Software Protection Method Based on Improvement.
To sum up, the present OTP cryptographic key generation methods cannot meet the requirement of cloud storage data security for OTP random cryptographic key.